The Linux kernel contains a data race in the fuse‑uring ready flag that can cause a CPU to observe the flag as set while still using a stale or invalid FIQ operation pointer. On weakly‑ordered architectures the store to the operations pointer may be reordered after the ready flag store, allowing an attacker to dispatch requests through a stale pointer, potentially corrupting kernel state or causing a crash. The vulnerability also hides a marked‑vs‑unmarked access that the kernel safety checker will flag. The fix upgrades the store to smp_store_release and the load to smp_load_acquire, and wraps the ready flag checks with READ_ONCE to guarantee visibility and prevent stale dereferences.

All Linux kernels implementing fuse‑uring that do not yet contain the commits that introduce the smp_store_release/smp_load_acquire and READ_ONCE wrappers are vulnerable. The description does not enumerate specific kernel versions, but any build prior to the commits referenced (46725a0056c884cf58a6897f222892807327d82d, b156bb9966972122b148acab8bdf415cdb8176a3, d01a09b442cb786cd44ccc7c84d57e2856d6737c) is vulnerable. The flaw is not listed in CISA’s KEV catalog and the EPSS score is unavailable.

This is a kernel‑level concurrency bug that can lead to denial of service or kernel memory corruption. The CVSS score is not provided, but the nature of the flaw suggests high severity. Exploitation requires local access that can trigger fuse‑uring operations; no public exploit has been reported and the EPSS score is unavailable, so the likelihood is uncertain. Nonetheless, operators should treat the vulnerability as an elevated local risk until the patch is applied.